System and method for capturing and reporting online sessions

ABSTRACT

The present invention discloses a computer system for reporting online sessions and a computer enabled method utilizing the same. The computer system is made up of an icon that preferably appears on a user screen. The icon is capable of capturing a screen session on the user screen and saving it within a recording. The recording may then be communicated to a database server that is capable of extracting a plurality of target components from said recording, and is capable of storing them in a database. The database may contain a benchmark content of the plurality of target components. Target components may then be compared against the benchmark content in a variety of ways to determine whether the level of target components is above or below reasonable and socially accepted levels.

FIELD OF THE INVENTION

The invention relates to a computer system and computer enabled methodfor monitoring activities occurring during a display session.

BACKGROUND OF THE INVENTION

The invention relates to a telecommunication system and a method forusing such a system to record, store, archive and report activitiesoccurring on a user's (computer, television, electronic gaming device,telephone, cell phone, e-fax, or any other type of electronic ortelecommunication display). The preferred use disclosed in the presentinvention may be to capture electronic mail (email), text, voice and orvideo chat using speech recognition, images, video or chat sessions forrecords or for a possible review and investigation. The aim is to have atool that can readily capture and record an ongoing event both onlineand in person that a user of this event deems to be offensive,threatening or otherwise suspicious. In addition to these sessions itcan also be used to capture, record, archive, forward, store, report orotherwise transfer materials deemed as offensive, alarming orinappropriate such as websites, facebook or myspace “social media type”pages, web blogs or “blogs” or any other type of event, picture, graphicor communication media that the user may regard as needing to bereported. However, the present invention may be used for other purposes,for example, as a record keeping tool for recording applicationsessions, reporting violations of company and other institutionalpolicies or a person witnessing someone leaving luggage alone at anairport. Presently, a lot of interpersonal communication occurs over thecourse of chat and email sessions between individuals and groups. Thesechat sessions usually take place between two or more remote users thatare connected to the World Wide Web or the internet, or the globalcomputer network (GCN). Chats may also occur over a local area network,for example between employees of a single enterprise, or electroniccommunication may also take place over the global system for mobilecommunication (GSM), or a similar communication system that provides acommunication network for wireless devices.

Chat and email, and other electronically enabled communication forumshave many benefits. For instance, two remote locations or individualsmay now be linked together instantaneously, considerable privacy anddiscreteness may be provided, especially if the messages are encrypted,and chat and email is almost always free of charge. Additionally, mostrecent software innovations have enhanced the ease of electroniccommunication channels. For example, advances such as stateful orthreaded chat room presence enables remote users to monitor whethertheir chat buddies are connected to the internet, or whether they havestepped away or are too busy to participate.

However, electronic sessions also offer some significant caveats anddrawbacks that the present invention addresses. One downside ofelectronic communication versus more traditional methods is that suchcommunication often occurs between unfamiliar parties. Most often, theusers are only able to see the other side's input characters, but notthe individuals themselves, their demeanor, body language or age. Suchcommunication is driven by trust, a trust that is often abused and usedto exploit the naïve or unwary. However, even in cases where users knoweach other, there may be times where the substance of an electronicexchange involves topics that can potentially pose significantconsequences to those involved in the conversations or to the object ofthe conversation. When this occurs, either party may want to record theexchange, or even to alert a responsible third party, such as lawenforcement, a regulatory body, an overseeing party, or a party havinglegal interest. Thus, a primary purpose of this invention is for a userto be able to notify Safety Net Interactive, Inc. or any otherdesignated or licensed entity that is contracted by SNI of predatory,improper, illegal or otherwise prohibited behavior experienced in aonline or in person event.

Presently, virtually all software tools that enable remote communicationalso offer ways to store or record a particular communication within arecord, a file or other means. However, multiple individual sessionsmust be recorded separately. This is also true for non-internet relatedsoftware applications. Each separate instance of a software applicationmust be separately memorialized and recorded. Additionally, saving isnot always available, and a screen capture may be the best solution.Also of significance, is that the presently available screen capturetools create an image that cannot be searched or edited, whereas thepresent invention is able to parse the image in search of text stringsand characters.

Furthermore, the effectiveness of these computer and othertelecommunications systems that are state of the art are significantlyreduced by the lack of a direct reporting link between a party doing therecording and a party interested in its contents. For example, a privatecitizen or a business associate may lack the knowledge or ability tocontact proper echelons of law enforcement or other authoritative,corporate, organization or legally interested parties (schools, towns,states or country) to report threatening, abusive, bullying abrasive,sexually explicit or any offensive communications. On the other end, Lawenforcement, schools, towns states, country or corporate complianceofficers may lack tools or knowledge in determining whether something isbenign or truly ominous.

Finally, the present methods often do not guarantee confidentiality. Thepossibility of exposure of a particular exchange and negativeconsequences of such an exposure on a victim, frequently discouragereporting. For example, youngsters may be reluctant to contactauthorities for fear of alerting parents or school officials. Juniorstaffers may fear that disclosure may expose their online or socialactivity to their superiors and jeopardize their employment prospects.The present invention addresses this by providing an independent thirdparty analyzer tool that can determine if the sessions are truly hostileor offensive, and which is able to alert law enforcement or anotherappropriate remedial body, without also alerting the victim's parents orsuperiors.

Various implements are known in the art, but fail to address all of theproblems solved by the invention described herein. One embodiment ofthis invention is illustrated in the accompanying drawings and will bedescribed in more detail herein below.

SUMMARY OF THE INVENTION

The present invention discloses a computer system for reporting onlinesessions and a computer enabled method utilizing the same. The computersystem is made up of an icon that preferably appears on a user screen.The icon is capable of capturing a screen session on the user screen andsaving it within a recording. The recording may then be communicated toa database server that is capable of extracting a plurality of targetcomponents from said recording, and is capable of storing these targetcomponents in a database. The database may contain a benchmark contentof the plurality of target components. Target components may then becompared against the benchmark content in a variety of ways to determinewhether the level of target components is above or below reasonable andsocially accepted levels, or other configurable levels.

Therefore, the present invention succeeds in conferring the following,and others not mentioned, desirable and useful benefits and objectives.

It is an object of the present invention to provide a screen capturingtool of a user's display session.

It is another object of the present invention to provide a reportingtool, where a user's screen session is reported to an independent thirdparty or analyzer.

Yet another object of the present invention is to provide a reportingtool that is capable of parsing captured images into searchablecharacters and strings.

Still another object of the present invention is to provide a tool withvarious algorithmic approaches for determining whether the content ofthe target components represents a sufficient threat to warrantattention of law enforcement or other enforcement agency. After it hasbeen through the system and has had a SNI screener also look at it.

Still another object of the present invention is to provide a reportingtool having an independent database for storing reports and benchmarkcontent.

Yet another object of the present invention is to provide a searchmodule to law and policy enforcement officers, who may search thedatabase against a set of target components.

Still another object of the present invention is to provide a capturingtool that may be started automatically as a background process, andwhich can be activated with a click of a mouse or another type of fastactivation.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a flow chart of a computer system disclosed in by the presentinvention.

FIG. 2 is a flow chart of the computer enabled method of the presentinvention.

FIG. 3 is a more detailed flow chart of some aspects of the computerenabled method.

FIG. 4 is a diagram of commonly found software and hardware componentsof a typical computer system.

DESCRIPTION OF THE PREFERRED EMBODIMENTS

The preferred embodiments of the present invention will now be describedwith reference to the drawings. Identical elements in the variousfigures are identified with the same reference numerals.

Reference will now be made in detail to embodiment of the presentinvention. Such embodiments are provided by way of explanation of thepresent invention, which is not intended to be limited thereto. In fact,those of ordinary skill in the art may appreciate upon reading thepresent specification and viewing the present drawings that variousmodifications and variations are possible.

Referring now to FIG. 1, shown are the main components of the presentinvention, namely, a computer system 5, an online session 10 connectingto a global computer network (GCN) or the Internet 338 (FIG. 4), an icon20, a user 25, a user screen 30, a recording 35, a database server 40, adatabase 50, a relay server 60, a search module 110, access by thirdparties 120.

An online session 10 may be referring to any session that is currentlyoccurring on the user's screen 30, including, but not limited to, a wordprocessing or data entry sessions, or any other administrative sessionswhich may need to be recorded for a later review. Preferably, the onlinesession 10 refers to a chat session, an email session, a blog session orany other session that represents a communication over two or moreinterconnected user systems 300. The interconnected user systems 300 maybe connected via the internet 338, or reside in a local area network(LAN) of a public or private enterprise, or a non-commercialestablishment. Whatever the setting, the present invention may be usedto record specific type of communication; for example, violent, vulgar,predatory, threatening, or sexually explicit messages and images.Alternatively, the present invention may also be used to record anyother kind of communication for the purposes of records keeping.

A typical session occurs over the internet 338 from a user screen 30 byusing a web browser, such as, but not limited to Internet Explorer,Mozilla Firefox, Apple Safari, Google Chrome or Netscape Navigator orany other browser enabled for this purpose. A user may access a websiteto launch a separate chat application or the chat application may beinstalled locally or get launched outside of the web browser. Otherchatting applications may exist within other types of applications; forexample a Sametime® application may be launched from within an IBM'sLotus Notes® application.

The icon 20 may be referred to as the client application that runsindependently, managed only by the local operating system 310 of theuser system 300 where the icon 20 has been installed or running. Theicon 20 may be a stand alone software application that is capable ofreceiving, initiating or maintaining contact with another user system300. In the present invention the icon 20 may need to be in contact, ormay receive and send messages and other data between the user's computer300 and either the database server 40 or the relay server 60. Dependingon the scale of the embodiment, either the database server 40 or therelay server 60, or both, may be present in an embodiment of the presentinvention. Additionally, the icon 20 may communicate with the databaseserver 40 through the relay server 60, or the icon 20 may communicatedirectly with the database server 40.

The icon 20 contains an iconic or a graphical front end of an overallsoftware application, where all parts may be written in C, C++, C#,Visual Basic, or any other language, such as Java, that may be used tocreate software for data and transactional processing. The icon 20 maynecessarily need to interact with system resources and interfacesprovided by the operating system 310. One skilled in the art of softwaredevelopment may appreciate that an application of this type may includecode sections or objects for interacting with system resources, such ashardware resources, CPU time, and processing or network bandwidth.Alternatively, an application may be build within a COM or COM+framework or a .Net framework, or a Websphere or a Weblogic framework,or any other framework, where all standard system, security, networking,and data management objects, as well as most graphical objects aresupplied by the framework software, with a skilled developer supplyingthe business logic necessary to enable the icon software 20functionality described herein.

The graphical interface of the present invention may preferably becontained within the icon 20 which may be running as a separate serviceor a daemon, and which may be present in miniature within thenotification section of a Windows® task bar. The icon 20 may also be setto run upon request such as a mouse click on a miniature desktop orstart menu icon representing the icon 20, or the icon 20 may be runningas background process in any other type of runtime environment, where aruntime environment refers to a combination comprising an operatingsystem 310, hardware resources and a preferred blend of other ancillaryapplications. The icon 20 may be further enhanced with logic enablingpopup notifications or an event monitor to respond to mouse-over eventsor other usage events. When a user wishes to record an online session10, he or she may activate the icon 20 with a click of a mouse or atyped command, to bring up a supporting interface or to expand theinterface within the icon 20. The icon 20 may also be activated quicklywith a hotkey, a keyboard key or key combination assigned by the icon 20for such operation.

In another embodiment, the icon 20 may be a highly intelligent serverapplication that would monitor the network interface 324, keystrokesfrom the keyboard 328 or mouse 330, or objects appearing on the screento determine whether a maximum threshold of a certain type ofinformation has been reached. Once reached, the icon 20 may beconfigured to automatically initiate a recording of a session or aparticular part or application appearing on the user's session 30. Theicon 20 may also contain a drag and drop area, where only the sessionsthe user wishes to record are captured by the icon 20 with the othersessions remaining private.

The icon 20 preferably sends data remotely to a listening service suchas the database server 40 or the relay server 60. Either of theseservers may be running a flavor of Windows, UNIX or Linux platforms.Other platforms may be adopted without departing from the spirit of thepresent invention. These remote servers represent a remote storage andanalysis location, where the recording 35 may be parsed, sorted andanalyzed to determine a degree of compliance or a level of a violationof certain preset or standard levels of acceptable human interaction. Inanother alternative, the entire computer system 5 may be partially orentirely contained within a user's computer 300.

It is preferable that the icon 20 on the user's user system 300 or onanother type of user device communicates with the relay server 60. Theicon 20 may contain an internal list or a database that would containinformation necessary to establish contact with the relay server 60,such as, but not limited to an internet protocol address, a domain name,and any necessary metadata and command syntax necessary to establish aneffective one or two way communication. Alternatively, all connectivityinformation may be stored on the relay server 60. The relay server 60may periodically poll all subscribing user systems 300. One skilled inthe art would appreciate that a single database server 40 or a singlerelay server 60 may interact with a plurality of individual user systems300, also known as personal computers. This interaction may include, butis not limited to, software and configuration updates, I-am-alivepolling, licensing and subscription sync, and data uploads from icon 20and downloads to icon 20. Data uploads from icon 20 may preferablyinclude an upload of the recording 35, but may also include others typesof data.

The polling may initially be set up according to a user agreement, suchas a subscription, a software download, or a licensing agreement. Ineither scenario, the relay server 60 may periodically update the icon20, or any underlying client or database server, with latestconnectivity information, as well as other information, such assubscription or service updates, software patches and updates, or totransfer any recordings 35 that may be stored locally and that are readyfor an upload to the relay server 60 or the database server 40. Itshould noted that any discussion of the relay server 60 may also be aapplied to the database server, and visa versa, since in somealternative embodiments only one of the servers may be present.

The relay server 60 may be capable of authenticating the usercommunications 35 as well as any search communications, originating fromthird parties 120. The relay server 60 may also be capable ofmanipulating a recording file or a data stream that were received fromthe client session 30. The recording 35 in an unprocessed state may bean image object and may be communicated from the icon 20 to the relayserver 60 in a compressed state. The image object may be converted intoa character based record or file by using an Optical CharacterRecognition (OCR) technology, present in either the relay server 60 orthe database server 40. Alternatively, OCR routines may be executed onthe user session 30, which would result in a character based recording35. An OCR routine that is local to the icon 20 routine may be preferredto support smaller network bandwidth or lesser available processingcapacity by a relay server 60. In another alternative OCR may bereplaced by software that is capable of interpreting binary or machinenative language symbols of the recording 35, and convert these into ahuman readable or searchable format. This software component may resideon the user system 300, may be part of the icon 20 or may reside on therelay server 60 or the database server 40.

The converted or OCR processed recording 35 may now contain onlycharacter based data that is searchable using character mining routines,such as the data mining module discussed further. Basic character miningroutines are common with many high level languages, such as Perl, Pythonor Ruby, as well with the any other aforementioned, presently existing,or future programming techniques and languages. A character basedrecording is then transferred to the database server 40. Alternatively,the character based recording may be directly recorded in a database 50in its entirety or parsed into smaller records, for example byparagraph, by sentence, by word or even by character.

In another alternative, an OCR or a binary recognition componentdescribed herein, may communicate directly with the database 50, whereany discovered characters or strings may also be stored. In yet anotheralternative, the OCR or the binary recognition component may containintelligence to store certain image objects in their entirety. Thisfunctionality may be needed to enhance and advance the object of thepresent invention. The preferred object of the present invention is tocapture online dialogue containing offensive, hostile or sexuallyexplicit or suggestive terms. In some cases, the content of such anonline session 10 may be in form of a threatening, offensive orinappropriate image. Therefore, it may be highly desirable that thepresent invention may be able to distinguish between a target componentthat is a string or a character and a target component that is an imageor a graphical object. These hostile, threatening, inappropriate, sexualor otherwise offensive characters or images that may be contained withinthe recording 35 are also referred to as target components.

The database 50 may already be preloaded with examples of the targetcomponents. These examples may also be referred to as benchmark content.The database 50, the database server 40 or the relay host 60 may containconfigurable violation thresholds. These violation thresholds wouldspecify when the plurality of the target components within a particularrecording 35 crosses the line between safe and unsafe, unsafe andinappropriate, inappropriate and hostile, and between hostile andmenacing. Other levels or qualifications may be included, and may berepresented by qualitative or quantitative values. These levels may thenbe used to rank the target content of the recording against thebenchmark content already in the database 50. The rank would then becompared against the violation thresholds that may also be contained inthe database 50, to determine if an alarm or a notification isnecessary. Whether an alarm or a notification is created, the contentsof the recording 35 are preferably written to the database 50 for laterreference or for the purposes of augmenting the exiting benchmarkcontent. During processing, the recording 35 may be delimited andrecorded piecemeal; with any newly discovered target components beingcompared on an ongoing basis against the existing benchmark contentwithin the database 50. In this type of processing, a recording 35 thathas already been reformatted with OCR technology, may also be fullyranked or be ready for a violation determination.

The communication 35 between the icon software 20 that is part of theuser session 30 and the relay server 60 or the database 40 may be atransmission control protocol over the internet protocol or TCP/IP, peerto peer protocol, or a token ring protocol, or any other protocolsuitable for enabling a data transfer that would support the objectivesof the present invention. The recording as well as other data exchangemay be sent via standard file transfer protocol (FTP), anonymous ftp,secured ftp (SFTP), or HTTP GET and PUT commands.

It is preferable however, that the recording is transferred using aWindows Communication Foundation (WCF) framework, or its equivalent. Ina WCF framework the relay server 60, the database 40, or the icon 20 maybe classified as services having a separate proxy handling all of theconnectivity information, security requirements, and data transmissions.The connectivity information as well as object call syntax may beadvertized by a WCF service in a technology-neutral way, for example asa response to an HTTP-Get prompt. In this architecture, a componentrequesting a service would be classified as a client, while thecomponent providing a function would be considered a service. Forexample, the icon 20 may be requesting that the relay server 60 receiveand process the recording 35. Therefore the icon 20 would be requestinga server while the relay server 60 would be providing a function. Theroles would be reversed if the contact is originating on the relayserver 60, which may be requesting some kind of response from the icon20.

The increased benefit of the preferred transmittal embodiment using WCFis that it may be largely technology neutral and may be easily scalablefrom an all-in-one local installation to an enterprise or to an internetwide dispersion of components. Technological neutrality arises from thefact that WCF supports bridging software, such as HTTP bridges, and cantherefore communicate with embodiments of icon software 20 running onnon-Windows based platforms, such as, Linux or Macintosh. Additionally,WCF or its equivalents offer a wide range of security and encryptionfeatures, such as, but not limited to a Kerberos or Windows®authentication, use or certificates or tokens, username and passwordcombinations, or any other types of encryption and/or authentication, orany combination of these encryption and/or authentication methodologies.

The search module 110 may reside on the relay server 60 or on thedatabase server 40. The search module would preferably contain agraphical front end and provide an interactive search interface. Thesearch module 110 may contain several levels of searching complexity,ranging from a simple character or number match, to Boolean or Advancedkey term matching, complete with globing and expansions.

The search module 110 may contain a presentation layer and maypreferably be accessed by authorized third parties 120 via the internet338, by using a web browser. Third parties 120 may access a particularinternet address (a web site) that would host the search module 110, byentering its uniform resource locator (URL) address. The entry wouldconsist of a computer address and a string instruction that is thenforwarded over the internet 338 to the computer responding to theparticular URL. The string instruction is then interpreted by a webserver on the addressed computer. The string instruction and may beencapsulated in the form of a standard common customer gateway (CGI)syntax, or contain any other HTTP required syntax, or a WCF requiredsyntax, or an SSL required syntax or any other required syntax. Thestring instruction may contain a required command or service modulesyntax required by the WCF service that supports the search modulefunctionality of the present invention. Such a WCF service maypreferably also reside on either the relay server 60 or the databaseserver 40 or any other server aligned with the relay server or thedatabase server 60 or 40. It should be noted that for the purposes ofscalability, the relay server 60 or the database server 40 may be splitover several hardware enclosures, each with its own CPU 302, where thehardware enclosures would work in concert to magnify the bandwidth ofthe computer system 5, or to support failover functionality.

The search module 110 may be written in any language that can render orsupply web browser content, coupled with a technological ability torender interactive web pages, or web pages that are capable of receivingand responding to input from a user. A typical web page may be renderedin a markup language that a web browser is able to interpret such asHTML or XML or any other markup language capable of rendering anappropriately styled and sized web page. An interactive web page mayadditionally have a separate interactive content rendered usingcascading style sheets (CSS), or in a high level language such as AJAX,ColdFusion, Perl, JavaScript or Ruby. Alternatively, the entire webpagemay be rendered in a cascading style sheet that may be written in anyhigh level language mentioned herein or commonly used in the art forthis purpose. The search module 110 may be started as a service oneither the relay server 60 or the database server 40. The service forthe search module 110 may be assigned to a specific port number that maybe the same or different from the port number used by the icon 20 totransfer a recording to the relay server 60 or the database 40 or toperform any other remote task. The port referred to would preferablyreside within the application layer of OSI defined architecture forcomputerized transmission. Such a port number may be assigned andmanaged by the operating system 310 to handle requests for a specificapplication.

The search module 110 may be managed by a web server, such as ApacheTomcat or Microsoft IIS, which may be configured to listen on a port,such as a default port 80, 8080 or 8000, and directed to start aninstance of the search module 110. The search module 110 and itsgraphical or browser based front end may written in any language, suchas, but not limited to Java, C/C++, C#, Ruby, Perl, Python, as well astheir parent languages or any dialects influenced by these languages. Asan additional or alternative feature, the search module 110 may containa command line interface that may respond to an HTTP get request or itsequivalent with an appropriate search result. Such a command line searchmodule 110 may similarly listen on a port and may be accessed using anIP and port combination.

The search module 110 is intended to be used by third parties 120,preferably by technical administrators and managers of the computersystem 5, or by law enforcement or relatives of the user 25. Preferablythe search module 110 contains an authorization or authenticationroutine that verifies whether a third party 120 is able to utilize thesearch capabilities. The third parties rights may be explicitly providedby an administrator of the present invention or automatically by consentof the user 25. The search module 110 preferably searches the database50 by matching a search string or a combination of search strings alongwith any attributes that are composed by a third party 120.Additionally, the search module 110 may contain its own statisticalinformation or may be able to access statistical information compiled bythe relay server 60 or the database server 40. Such search module 110may be able to respond to a query whether a particular target componentshould be deemed safe or hostile, may return prior incidents or similarincidents involving the same usernames or actual users, of both theoffender and the victim, or any other type of relevant and searchableinformation. The search module 110 may be capable of wrapping individualsearch terms into a term within a Structured Query Language (SQL), thusconstructing a query to be executed on the contents of the database 50,with the results appearing within the search module 110 or sent directly110A to the third party 120.

The database 50 may preferably be capable of keeping track of records byusing a data dictionary. Furthermore, a database 50 should preferablymaintain a failure recovery medium to preserve transactions in an eventof a failure, crash or in an event of a retraction of a transaction by auser or a process. The examples of databases include, but are notlimited to Oracle Rdbms, Sybase ASE, IBM DB2, as well as Informix andMySql. Use of other databases may also be possible, even a simple commaor whitespace separated file lists may be used as a record storagemedium.

The particular way in which a database server 40 interacts with thedatabase 50 may likely depend on an embodiment, topology, application,or physical equipment. In general, every high level computer language,as well as any application server contains its own applicationprogramming interface (API) with instructions, libraries andsub-routines that enable a seamless communication with any type of adatabase used. For example, open database connectivity (ODBC) provides astandard by which many languages may connect to a database. Somelanguages provide proprietary wrappers for ODBC, such as Java's JDBCbridge for OBDC. Other languages or software development platforms mayinclude database classes, objects and services that assist withinteraction between the relay server 60, and the database server 40.

FIG. 2 is a flowchart describing the computer enabled method disclosedby the present invention. The steps shown are activating an icon on ausers personal computer 200, utilizing said icon to capture a screensession on user computer system 205, capturing a user session on saiduser computer system into a recording 210, sending said captured screensession to a remote database having a benchmark content 215,communicating said recording to a relay server 220, delimiting saidrecording into a plurality of target components 230, the step ofcomparing said plurality of target components against said benchmarkcontent 235, and the step of granting search access to said database tothird parties 280. For brevity of description, the aforementioned stepsmay be referred to by their respective number or by a full or partialstep title.

The step of activating an icon on a user computer system 200 may includea download or installation of the necessary computer instructions thatwould be compiled into a computer program or a software packagerepresented by icon software 20, where the download occurs on a userspersonal computer or user system 300, and the launch of a fully enabledicon software 20 that is ready to record the user session 30. Some orall parts of this step may be necessary for the first launch, only. Forexample, the download of the icon software 20 may only be needed for thefirst use of the present invention.

The step 200 entails that the icon 20 has been installed, configured andis loaded, or ready to be loaded into the memory of the personalcomputer 300, or any other user device, such as but not limited atelephone a cell phone, a smart phone, a personal organizer, a webdevice, a television, a video or voice recorder, or any other devicehaving a screen or a capability of recording data objects. One skilledin the art would appreciate that there may be many variations andoptions of creating a computer program personified by the icon 20. Itmay be highly preferable that a user 25 is capable of launching the icon20 quickly and conveniently. To facilitate this, it may be preferablethat some part of the icon 20 is preloaded into the computer systemmemory 308 at start-up of the CPU 302 or upon login of a particular user25.

The launch of the icon 20 should preferably not interfere in the ongoingonline session 10, so as to not alarm or disconcert the source of theoffensive communication into performing a more drastic action. The icon20 may also contain functionality to warn the user 25 that a source ofthe offensive communication may be attempting to perform otherundesirable or invasive tasks, such as, but not limited to logging intothe user system 30, attempting to view or perform other operations withsystem data, or install or remove applications, such as sniffers,backdoors, and other hackwork and spyware. In another alternative, theicon 20 may be able to alert a firewall, anti-spyware, or anotherintrusion prevention means. Additionally, it would be preferable thatpart of the activation step 200 includes routine maintenance functionsof the icon 20, such as, but not limited to search and installation ofupdates, internal error reports and licensing maintenance. Maintenanceand transfer of the recording may occur over the same or differentcommunication channels between icon 20 and the relay server 60 or thedatabase server 40.

The step of utilizing said icon to capture a screen session on a userdevice 205 preferably refers to utilizing the icon 20 to captureobjectionable communication. In Windows® based embodiments the icon 20may be running as a background process, with some representation of itspresence manifested on the user screen 30, such as a miniature iconresiding in the notification tray of the task bar. Alternatively, thecomputer logic enabling the icon 20 may listen to a specific activationevent, such as, but not limited to a depression of a designated keyboardkey or a hot key, or a combination of such keys. Alternatively, the icon20 may periodically scan the user screen 30 for objectionable text.

The user screen session 30 or a user device may also be referring to, orattributed to a mobile device, such as, but not limited to a cell phone36, an organizer, a smart phone, a web device, a television, anelectronic gaming device, a telephone, an e-fax, or any other type ofelectronic or telecommunication display, or any device with a display. Auser device be capable of supporting a background execution of the iconsoftware 20, or the icon 20 may be initiated separately, such as aresult of menu item selection. This icon 20 may have all or some of thefunctionality of the icon embodiment that may exist on a user system300. Alternatively or additionally, such the icon 20 running on anon-user system 300 may be supporting of services provided by thedevice. For example, the icon 20 may have an ability of capturing text,voice and/or video chat, using speech recognition, or capturing imagesor video. Such recording would then be transferred to the computersystem 5 as a recording of objects, such as image objects, oraudio/video objects. The computer system 5 may contain modules, such asOCR that may parse and extract characters and images from such objects,or which may first convert the recording in an intermediary format thatmay then be sent to a module such as an OCR.

An icon 20 may contain command-line interface, or a graphical interface,or a combination of both interfaces. A user may choose, which particularcommunication sessions or application screens should be captured,otherwise all screens and sessions currently open, maximized orminimized may be captured into a recording. In another of the sameembodiment, individual sessions maybe dragged and dropped into an areaprovided by the icon 20. Additionally, it may be possible to uploadfiles containing independently saved sessions or application screens,into the icon 20. It may also be preferable for the icon 20 to becapable of identifying which sessions are open, or distinguish whichsessions are in the foreground and which are in the background,selecting only sessions within a specific group of sessions.

The step of capturing a user session on said user computer system into arecording 210 preferably involves the icon 20 and a sub-screen orsub-menu included with the icon 20. However, all operations may be donefrom a single screen of the icon 20. A sub-screen or a sub-menu, ifincluded, may be referred to as a user reporting screen. A userreporting screen may prompt for a type of reporting, for example, acyber bully or a predator. Other type of reporting may be moreapplicable to a professional or work related setting, where a type ofreporting may include a breach of company policy, a general unwantedcontact. Some types of reporting may be instead of, or in addition tothe standard cyber bully or predator reporting. The user 25 may becapable of entering any or all information pertaining to the source ofthe unwanted or offensive contact, such as, a user name, a real name, aposition, address or location, explanation of why contact may beoffensive, or description of how the user and the source becameacquainted, and any other relevant information that may assist inrecording the contact, seek prior acts or alert law enforcement andother regulatory bodies. The resulting recording may be an image file ora binary archive that is compact enough to be sent from a user system300 to a remote relay server 60 or a database server 40, with reasonableexpediency and efficiency.

The step of sending said captured screen session to a remote databasehaving benchmark content 215 preferably describes the application of theclaimed method to the preferred or alternative networking and datatransfer methodologies. As an example of step 215 may be the icon 20contacting the relay server 60 or the database server 40 based on apre-existing setting specifying the remote address of these servers 60or 40. Preferably, the addressing is based on interne protocoladdressing system that is based on either the 32 bit or a 128 bitaddressing, or any other addressing that is commonly used in the art andfor this purpose. The address may be preset during installation oractivation of the icon 20, or periodically, passively supplied by therelay server 60 or the database server 40.

The icon 20 may use any type of file and data transfer techniques, suchas File Transfer Protocol, or a Secure File Transfer Protocol, or aRemote Copy Protocol. However, preferably, the recording may betransferred using a WCF. Using WCF may be more efficient and fastermethod of data transfer, since in WCF data can be communicated directlybetween the supplier and the consumer of the data, bypassing the lengthyprocess of recording a file, transferring it to a target location, andthen reading the file from the new location. Additionally, WCF mayprovide enhanced security over older FTP and SFPT technology. Anotherbenefit of using the preferred data transfer technique is that itpermits the icon 20 to log in once for the entire length of the sessionor the entire active state of the icon 20. Alternatively, the login mayoccur automatically in the background, and remain logged in for a largeportion of the active period.

The step of communicating said recording to a relay server 220 includessending the recording to the relay server 60 or the database server 40,in an embodiment lacking the relay server 60. The database server 40 mayfunction as a backup to the relay server 60, in the event of an outageon the relay server 60. The relay server 60 may preferably be a remoteserver to the icon 20 and is capable of serving multiple user sessions30. Each user session 30 may communicate and exchange data with therelay server 60 apart from, and completely insulated from activities byother user sessions 30. It is highly preferable that individual usersessions 30 are not aware of the presence of other user sessions 30, anddo not affect each other's activities.

The step of delimiting said recording into a plurality of targetcomponents 230 may preferably occur on the relay server 60. The relayserver 60 may be equipped with optical character recognition (OCR)software. OCR software would process the binary format of the recording35 received from the icon 20 by extracting characters, characterstrings, sentences or graphical objects. A recording 35 may consist ofscreenshots and other data. It may be preferable that an OCR may becapable of determining which characters should be grouped together toform words and sentences. It may also be preferable to extract graphicalobjects that may be deemed offensive or otherwise objectionable. Thecharacters and other objects extracted with OCR represent targetcomponents that will be now compared to the benchmark components, todetermine whether the contact was in violation of certain communicationnorms or regulations. Other examples of target components may beclassified as identifying information, such as, but not limited to theoffender's or victim's interne address, geographical location, age, sex,time and date of contacts. An example of OCR software may be MaestroRecognition Server® from OCITech®; however, many other OCR platforms maybe implemented with the relay server 60.

The step of comparing said plurality of target components against saidbenchmark content 235 may occur on the relay server 60 or on thedatabase server 40. At this point the recording has preferably beenprocessed by OCR software and even converted into a searchable textformat. For example a typical chat screen may contain graphical widgetsand diagrammatic windowing information in addition to the standardcharacter based conversation of the chat participants. Chat participantsmay also splice up their messages with illustrations, such as smileyfaces and animations. Existence of graphical elements will likely leadto errors in a character based searches, since a binary file usuallycombines characters with non parse-able or display-able symbols.Therefore, OCR or another form of parsing or delimiting technology maybe highly preferable for separating characters from graphics and otherbinary objects. Once this is done, a standard character search may beperformed on the character components of the recording 35, while abinary or object search may be done on the graphical or non-characterpart of the recording. The object of the search may be to extractparticular target components, their frequency and severity, and comparethe result against a benchmark content stored on the database 50.

The recording that has preferably been processed by OCR may then besearched by automated data crawlers such as the data mining module ofthe present invention or other modules that determine existence of aparticular target component within the recording 35. The analysis of therecording 35 may be based on many algorithms. For example if a usersession 30 has transferred a cyber bully type of a recording, thealgorithm may attempt to initially obtain a user name and/or password ofthe alleged cyber bully and the victim, or user of the user session 30.This information would then be compared against equivalent contentwithin the database 50, to determine whether there was a prior incidentinvolving either of the parties, together or separately, or whetherother contact information may exist for the alleged cyber bully.

Other algorithms may first consult the benchmark database 50 for acollection of target components that may be present in this type of arecording 35. A character search of the contents of a recording 35 maybe used to determine whether any of these terms are present and theirfrequency. An additional level of sophistication may also be capable ofdetermining the demeanor and predisposition of the author or the allegedcyber bully, based on specific phrases, their contextual location, andof specific speech patterns. Other keywords may be specified manuallyand compared against the target components present in the recording todetermine a match and frequency of the match. Still other algorithms maylook for a frequency of something appearing or not appearing, where thefrequency variable would influence a severity variable, or visa versa.Each algorithm or a combination of algorithms, used separately ornested, may return a quantifiable result. Algorithms look for IPaddress, user or screen name, name of the location where the offence ishapping (which chat room or what website, blog or e-mail sender) timeand date, speech patterns and keywords. Because one person can use morethan one computer and can change their screen or user name we cannotjust use one algorithm.

At the end of the analysis, the data mining module, or the businesslogic present on the relay server 60 or the database server 40 maydetermine the level of violation exhibited by the communication contentpresent in the recording. The level of a violation may be assigned acertain grade level or a certain severity description, may be colorcoded or classified in any other manner common in the field. Either thedatabase server 40 or the relay server 60 may be instructed to alert anappropriate regulatory body or division, in the event that some presetviolation threshold has been breached. It may then be reviewed by ahuman screener, once the screener has determined that this is a trueproblem then the regulatory body or division preferably represents thethird parties that may be allowed access to or hold a unique interest inavoiding violations. Examples of such third parties may be, but is notlimited to, law enforcement agents, policy enforcement officials,parents, guardians, school officials or corporate officers.

The step of granting search access of the database to third parties 280may be included, to provide law enforcement and other interest holdingthird parties, with independent or separate access into the database 50.Such access may be provided with search module, such as described inFIG. 1 as item 110.

FIG. 3 provides further detail on the step of comparing said pluralityof target components against said benchmark content 23. This step may bebroken up into the following steps: storing said recording within saiddatabase 240, integrating said plurality of target components into saidbenchmark content 245, determining a level of violation 250, notifyingthird parties of said level of violation 255, and the step of utilizinga data mining module to compare said plurality of target componentsagainst said benchmark content 270.

The step of storing said recording within said database 240 describes apreferable location for storing the contents of a recording 35. Thecontents or target components may be placed in a special transactionaltable space or an additional database that may exist for staging,transactional or other temporary purposes. Alternatively, there may be asingle database 50 for benchmark and target components, with the targetcomponents being assigned special flags to notify the database server40, or a third party 120 that is querying the database, of the temporarynature of the target components, if such access is in fact provided. Inanother alternative, the target components within the recording 35 maybe stored within a text file or an object file that is separate from orpart of the recording 35, whose content does not become part of thedatabase 50 until step 245, as will be described herein.

The step of utilizing a data mining module to compare said plurality oftarget components against said benchmark content 270 describes a way ofarriving at a violation level and thereby determining whether anotification of third parties is warranted. The violation may bedetermined by using at least one of the algorithms described in FIG. 2,which may be enabled using the data mining module of the presentinvention. The data mining module may be considered as the mostsignificant part of the business logic of the present invention, sinceit performs the comparisons between target components and benchmarkscomponents, and arrives at a level of violation. The business logic orthe data mining module may be a collection of several lesser softwarepackages or minor modules, or one large module. The data mining modulemay reside on the relay server 60 or the database server 40. It may alsoreside on the icon 20, especially in an embodiment where the icon 20 andthe database 50 are part of a self contained embodiment of the presentinvention.

The data mining module may be written in any of the languages heretoforedescribed, or may be written in a separate language, using a differentarchitecture. One skilled in the art of software development wouldappreciate that different components may utilize computer language andarchitecture that best suits the purpose of the software, and that mostof the disparate components may be integrated together at compile time,run-time, by using networking architecture or built-in software bridges,such as compatibility modules.

The step of determining a level of violation 250 compares the resultgenerated in step 270 by the data mining module against an acceptable orreasonable level of similar conversations in the same or similarsettings. Since the intended user of the present invention may be aminor or a child, where the parents or parties responsible for thischild may be seeking to create a safe or at least a defensible internetsurfing environment, the violation level of some communications may beset to a very low threshold; meaning that even a single objectionable orsuggestive statement may be considered as a reportable violation. Inother environments, such as professional settings, the thresholds may beadjusted to accept some forms of communications as normal, while stillmaintaining a low threshold on other types of communication. Forexample, where a user is a minor, any communication involving sexualmessages and innuendoes or any forms of violence or bullying may bestrictly prohibited and would immediately create an unacceptable levelof violation that would preferably need to be reported to an appropriateregulatory body, or even to parents or guardians of the minor. On theother hand, in business or professional circumstances, where the presentinvention is being utilized to monitor communication between workers ofa construction company or any other settings where a certain degree ofvulgarity may be acceptable, a threshold on the use of profanecommunication may be set higher than for a user who is a minor, whilethe threshold on violent or sexually explicit or suggestive language maycontinue to be low. Preferably the data mining module carries out thestep 250 and obtains the resulting level of violation. The data miningmodule and any sub-module may be prompted into undertaking the processand arriving at the result either automatically by internal processingof computer system 5, or by a human operator. Furthermore, it may behighly preferable that a human screen is then utilized to corroboratethe violation result arrived at by the data mining module or one of itssub-modules.

In the present invention, it may be preferable that a user 25 may becapable of reporting an attack or an offensive communicationanonymously, and that the report or the reported incident is notconveyed to the user's parents, relatives, guardians, superiors orbusiness associates. This may be preferred since a user 25 may fearreprisal, curtailment of activities, or may have been engaging inunauthorized or secondary activities during the incident. However, sucha user still maintains a right to be free of harassment, while lawenforcement and other regulatory bodies may still entertain asignificant interest in stopping sexual predators, cyber bullies, thugs,gangs, or other undesirables. Alternatively, the precise reportingstructure may be configurable based on the wishes of the user 25, theuser's parents, guardians, superiors, or by policy or statutoryrequirements. The configuration for reporting and for levels ofviolation may be stored within the database 50 or internally within thedata mining module. It may also be preferable that the levels ofviolation and the reporting structure may be configured within icon 20and stored in the user system 300, on the relay server 60, on thedatabase server 40, or in the database 50. It may also be possible thatthe reporting structure and levels of violation may be sent from theicon 20 as an attribute in the recording or in a supplementary file ordata stream.

The present invention may also contain a logging feature that may beaccessed by the user, or by appropriate third parties, such as but notlimited to the user's parents or guardians, and regulatory orenforcement authorities. Such logging may keep a record of anycommunication submitted in a record as a result of activating icon 20.Such functionality may be desirable if a user does not wish for anycommunication to be sent to law enforcement, or in the event that acommunication or an application may not be infringing or in violation,and yet the user may need to maintain a record for later reference. Suchlogging may be maintained locally on the user system 300 or remotely onthe database 50. The user may be able to specify what response may bedesired prior to submitting a specific recording. For example, a usermay not wish to report a particular communication to law enforcement,but wishes to monitor future behavior in an event that such undesirablebehavior continues or escalates. This user 25 may want or need to createa recording 35 for future reference, and may communicate his or herpreference as an attribute in the recording itself or in a supplementaryfile or data stream.

The step of notifying third parties of said level of violation 255 mayinclude an action of sending an alert to a subscribing regulatoryauthority. An alert may be manual or electronic, as illustrated in item110A (FIG. 1), informing law enforcement or an appropriate regulatoryagency that a violation has been committed, and the need to investigatethe violation. Regulatory, law enforcement, and disciplinary bodies maybe subscribing to services of the present invention, or may be passiverecipients of this information 110A from the present invention. Inactuality, once the data mining module determines that a level ofviolation has been breached, it generates a message to the databaseserver 40 or the relay server 60, which is then forwarded to theappropriate receiving third party 120. The information regarding theappropriate receiving third party 120 for a particular message may bemaintained within the database 50 or on the relay server 60, or on thedatabase server 40; with periodic updates requested from or receivedfrom the aforementioned third parties 120. It may also be highlypreferred that a detailed record of actions taken in step 255 may alsobe stored within the database 50 and linked to the perpetrator or victimfor a later reference or precedence.

The step of integrating said plurality of target components into saidbenchmark content 245 may be performed at any time during the executionof the claimed method. However, it is preferable to perform this step atthe end of the claimed method, so as to avoid skewing the resultsobtained by the data mining module in step 270.

Integration of target components into the benchmark content may becarried out to the database content referring to the parties appearingin a particular recording 35, or may be carried out to the overallbenchmark content. For example, it may be taken as a present state ofknowledge that what is socially acceptable or objectionable may changeover time. Additionally, some terms or speech patters fade into oblivionand are replaced with modified variations or entirely new statementsthat may contain the same or similar meaning. To maintain accuracy ofthe violation results, the data mining module needs to compare targetcomponents against a benchmark content that is socially current.Therefore, a separate module or logic built into the data mining modulemay be responsible for tracking speech trends, to detect an increase ora decrease of use of certain expressions or idioms. This step may alsobe done manually with the assistance of a human monitor, based onstatistics of usage or prevalence of terms that may be generated by thedata mining module or a separate trend monitoring module. Thusintegrating the target components of the present recording 35 may havean affect the overall technique of determining violations.

Step 245 may have a more localized affect. For example, the presentinvention may be used to monitor activities of a particular individualor a group of individuals. Communications by these individuals or tothese individuals may be benchmarked according to their priorcommunication to identify a trend or a pattern. The data mining modulemay identify a particular individual automatically, by using a username, internet protocol address, any URL or by individuals or sitescontacted, by an internet protocol (IP) address, a user or a screenname, or any combination thereof. In step 245 any contents of arecording 35 that are attributable to a particular user name may beadded to the database 50 as associated with this username for any futureanalysis.

FIG. 4 contains a further description of the hardware and softwarecomponents that are contained in a machine that would enable somecomponents of the present invention, in particular the user system 300containing the icon software 20. Therefore, FIG. 4 and the followingdiscussion are intended to provide a brief, general description of asuitable computing environment in which the invention may beimplemented. Referring now to FIG. 4, an illustrative environment forimplementing the invention includes a conventional personal computer300, also referred to elsewhere as a user system, including a processingunit 302, a system memory, including read only memory (ROM) 304 andrandom access memory (RAM) 308, and a system bus 305 that couples thesystem memory to the processing unit 302. The read only memory (ROM) 304includes a basic input/output system 306 (BIOS), containing the basicroutines that help to transfer information between elements within thepersonal computer 300, such as during start-up. The personal computer300 further includes a hard disk drive 318 and an optical disk drive322, e.g., for reading a CD-ROM disk or DVD disk, or to read from orwrite to other optical media. The drives and their associatedcomputer-readable media provide nonvolatile storage for the personalcomputer 300. Although the description of computer-readable media aboverefers to a hard disk, a removable magnetic disk and a CD-ROM or DVD-ROMdisk, it should be appreciated by those skilled in the art that othertypes of media are readable by a computer, such as magnetic cassettes,flash memory cards, digital video disks, Bernoulli cartridges, universalserial bus flash drives, external hard and flash drives, and the like,may also be used in the illustrative operating environment.

A number of program modules may be stored in the drives and RAM 308,including an operating system 314 and one or more application programs310, such as a program for browsing the world-wide-web, such as WWWbrowser 312. Such program modules may be stored on hard disk drive 318and loaded into RAM 308 either partially or fully for execution.

A user may enter commands and information into the personal computer 300through a keyboard 328 and pointing device, such as a mouse 330. Othercontrol input devices (not shown) may include a microphone, joystick,game pad, satellite dish, scanner, or the like. These and other inputdevices are often connected to the processing unit 300 through aninput/output interface 320 that is coupled to the system bus, but may beconnected by other interfaces, such as a game port, universal serialbus, or firewire port. A display monitor 326 or other type of displaydevice is also connected to the system bus 305 via an interface, such asa video display adapter 316. In addition to the monitor, personalcomputers typically include other peripheral output devices (not shown),such as speakers or printers. The personal computer 300 may be capableof displaying a graphical user interface on monitor 326.

The personal computer 300 may operate in a networked environment usinglogical connections to one or more remote computers, such as a hostcomputer 340. The host computer 340 may be a server, a router, a peerdevice or other common network node, and typically includes many or allof the elements described relative to the personal computer 300. The LAN336 may be further connected to a GCN service provider 334 (“ISP”) foraccess to the GCN 338. In this manner, WWW browser 312 may connect tohost computer 340 through LAN 336, ISP 334, and the GCN 338. Suchnetworking environments are commonplace in offices, enterprise-widecomputer networks, intranets and the GCN.

When used in a LAN networking environment, the personal computer 300 isconnected to the LAN 336 through a network interface unit 324. When usedin a WAN networking environment, the personal computer 300 typicallyincludes a modem 332 or other means for establishing communicationsthrough the GCN service provider 334 to the GCN. The modem 332, whichmay be internal or external, is connected to the system bus 305 via theinput/output interface 320. It will be appreciated that the networkconnections shown are illustrative and other means of establishing acommunications link between the computers may be used.

The operating system 314 generally controls the operation of thepreviously discussed personal computer 300, including input/outputoperations. In the illustrative operating environment, the invention isused in conjunction with Microsoft Corporation's “Windows 98” operatingsystem and a WWW browser 312, such as Microsoft Corporation's GCNExplorer or Netscape Corporation's GCN Navigator, operating under thisoperating system. However, it should be understood that the inventioncan be implemented for use in other operating systems, such as MicrosoftCorporation's “WINDOWS NT”, “WINDOWS 2000”, “WINDOWS XP”, “WINDOWSVISTA”, “WINDOWS 7” and various version of the “WINDOWS SERVER”operating systems, IBM Corporation's “OS/2” operating system, SunSoft's“SOLARIS” operating system used in workstations manufactured by SunMicrosystems, and the operating systems used in “MACINTOSH” computersmanufactured by Apple Computer, Inc, as well as for any flavor of UNIXand Linux operating systems available. Likewise, the invention may beimplemented for use with other WWW browsers known to those skilled inthe art.

Host computer 340 is also connected to the GCN 338, and may containcomponents similar to those contained in personal computer 300 describedabove. Additionally, host computer 340 may execute an applicationprogram for receiving requests for WWW pages, and for serving such pagesto the requestor, such as WWW server 342. According to an embodiment ofthe present invention, WWW server 342 may receive requests for WWW pages350 or other documents from WWW browser 312. In response to theserequests, WWW server 342 may transmit WWW pages 350 comprisinghyper-text markup language (“HTML”) or other markup language files, suchas active server pages, to WWW browser 312. Likewise, WWW server 342 mayalso transmit requested data files 348, such as graphical images or textinformation, to WWW browser 312. WWW server may also execute scripts344, such as CGI or PERL scripts, to dynamically produce WWW pages 350for transmission to WWW browser 312. WWW server 342 may also transmitscripts 344, such as a script written in JavaScript, to WWW browser 312for execution. Similarly, WWW server 342 may transmit programs writtenin the Java programming language, developed by Sun Microsystems, Inc.,to WWW browser 312 for execution. As will be described in more detailbelow, aspects of the present invention may be embodied in applicationprograms executed by host computer 342, such as scripts 344, or may beembodied in application programs executed by computer 300, such as Javaapplications 346. Those skilled in the art will also appreciate thataspects of the invention may also be embodied in a stand-aloneapplication program.

Although this invention has been described with a certain degree ofparticularity, it is to be understood that the present disclosure hasbeen made only by way of illustration and that numerous changes in thedetails of construction and arrangement of parts may be resorted towithout departing from the spirit and the scope of the invention.

1. A computer system for reporting online sessions comprising: an icon,said icon appearing on a user device screen and said icon controlling aclient application containing instructions that provide a functionalitycomprising: launching, on activation of said icon-controlled clientapplication by a user, a user-reporting sub-screen; and automaticallycapturing a current screen session on said user screen including saidreporting sub-screen or menu, if currently displayed, as a recording; adatabase server configured to automatically extract a plurality oftarget components from said recording by using, in part, opticalcharacter recognition software configured to extract characters andgraphical objects, and to separate said graphical objects from saidcharacters to eliminate errors in a subsequent character based search; adatabase configured to store said plurality of target components, saiddatabase having a benchmark content comprising a plurality of preloaded,socially current, exemplary expressions, idioms and speech patterns,defining, in part, at least two configurable violation thresholds,including a violation threshold between unsafe content and inappropriatecontent, and a violation threshold between inappropriate content andhostile content; automatically comparing, using a data-mining moduleoperating on said database server, said plurality of target componentswith said benchmark content to determine if a violation threshold hasbeen crossed by said plurality of target components extracted from saidrecording, and if a violation threshold has been crossed, automaticallydeciding whether to alert one or more third parties, said third partiesbeing selected, in part, dependent on a level of violation crossed andon a configurable reporting structure directly accessed by saidicon-controlled client application, wherein the level of violation isbased on specific phrases, contextual location, or specific speechpatterns.
 2. The computer system of claim 1, further comprising a relayserver, and wherein said client application communicates said recordingto said relay server.
 3. The computer system of claim 2, wherein saidrelay server converts said recording into a searchable format.
 4. Thecomputer system of claim 3, wherein said database server extracts aplurality of target components from said searchable format.
 5. Thecomputer system of claim 1, wherein said plurality of target componentscomprise one or more character strings.
 6. The computer system of claim1, wherein said plurality of target components comprise at least oneobject.
 7. The computer system of claim 6, wherein said plurality oftarget components are taken from a group comprised of an address, a setof keywords, an internet protocol address, a user or a screen name,speech pattern, or any combination thereof.
 8. The computer system ofclaim 1, further comprising a search module, said search module searchessaid database.
 9. A computer enabled method for reporting onlinesessions comprising the steps of: activating, using an icon on a usercomputer system, a client application containing instructions thatprovide a functionality comprising: launching user-reporting sub-screen;and automatically capturing a current screen session on a user deviceincluding said user-reporting sub-screen or menu, if currentlydisplayed, as a recording; automatically communicating, by said clientapplication said recording to a relay server; automatically delimitingsaid recording into a plurality of target components using, in part,optical character recognition software configured to extract charactersand graphical objects, and to separate said graphical objects from saidcharacters to eliminate errors in a subsequent character based search;automatically sending said plurality of target components to a remotedatabase having a benchmark content, said benchmark content comprising aplurality of preloaded, socially current, exemplary expressions, idiomsand speech patterns, defining, in part, at least two configurableviolation thresholds, including a violation threshold between unsafecontent and inappropriate content, and a violation threshold betweeninappropriate content and hostile content; automatically comparing saidplurality of target components against said benchmark content, using adata-mining module operating on said database server, to determine if aviolation threshold has been crossed by said plurality of targetcomponents extracted from said recording; and if a violation thresholdhas been crossed, automatically deciding whether to alert one or morethird parties, said third parties being selected, in part, dependent ona level of violation crossed and on a configurable reporting structuredirectly accessed by said icon-controlled client application, whereinthe level of violation is based on specific phrases, contextuallocation, or specific speech patterns.
 10. The computer enabled methodof claim 9, further comprising the step of storing said recording withinsaid database.
 11. The computer enabled method of claim 9, furthercomprising a step of corroborating said level of violation using a humanscreener.
 12. The computer enabled method of claim 9, further comprisingthe step of granting search access to said database to third parties.